Solved

Hi all, We have a FortiGate 81f running FortiOS 7.0.5. We have Application Control running that blocks proxy and vpn, which we want. We do however have one internal device (static IP) that we need to connect via vpn to an external ip.  We also have another internal device that requires connection to an external proxy. What is the best way to allow an internal ip to use vpn or proxy to contact an external ip? Custom IPS signature? thanks jc

Hello,Fortiweb offers the option to change password before logging in. If this option is used and the password change fails, where do I see the details?The login and therefore also a possible password change is done against a MS-AD.The user gets as error message "Failed to change password", but in the logs no reason can be seen.Unfortunately, the details under Log&Report / Traffic do not provide any clues for error analysis. Many thanksTBC

Hello everyoneI have the following problemOn page A I have a Foritgate with incoming traffic.Now the problem is the SRV's are on Fortigate side B.There is another IPSEC tunnel between the two Fortigates.How exactly do I have to configure the VIP there.Many thanks for your help

Can someone please help me get IPv6 configured?I'm on Xfinity and previously had OpenWRT configured with ::/60 prefix but having difficult time with 80F running 7.2.0 getting IPv6 addressNo matter what I do, the GUI does not record DHCPv6 prefix hint.What am I missing? config system interface edit "wan1" set vdom "root" set mode dhcp set allowaccess https set ident-accept enable set type physical set role wan set snmp-index 1 config ipv6 set ip6-mode dhcp set dhcp6-prefix-delegation enable set ip6-dns-server-override disable config dhcp6-iapd-list edit 5 set prefix-hint ::/56 next end end set dns-server-override disable next end(ipv6) # get ip6-mode : dhcp nd-mode : basic ip6-address : 2001:558:6030:7a:ccb4:xxxx:xxxx:xxxx/128 ip6-allowaccess : icm

Hi, I need to use someone to update signatures on Fortigate firewalls and not willing to give him super admin admin account. Is there any way to create an account with the minimum permissions just to be able to use execute restore ... command and update the firewall? Regards,  

Can somebody share a real scenario of load balancer configuration with couple of servers attached to it and spcify the traffic that comes from WAN to LAN with all the IP addresses. Thanking in advance !Nabi

Hi Community, can someone explain the meaning of "ret-no-match" in a debug flow on a FGT?As an example debug line see the following:"2022-07-01 09:04:45 id=20085 trace_id=32985 func=__iprope_check_one_policy line=1951 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"" I understand the line itself but not the meaning of "ret-no-match". Thanks a lot. Kind regardsDominik

Hi, Does the FortiGate and FortiManager support sending SNMPv3 INFORMs? If so does anyone have a guide please. Many thanks. Paul.

Does anyone have any suggestions on how to use Ansible to get around the admin initial password change of a brand new FortiGate? We stage dozens of FortiGates a quarter in an isolated manner.  Having to manually enter in the admin password first doesn't truly make this approach "zero-touch".  We've been searching and trying with Ansible, but I'm missing something? Thanks in advance for any help you can provide!  

Hello Fortigate team, I have a query, is it possible to perform a direct update of the Fortigate ios version in case the team is new without configuration. FortiGate 

Hi I've updated my Home office User from FortiClient 6.0.9 to 7.0.3 manually.With 6.0.9 We've a tool to modify the installer to VPN only.With 7.0.3 I download FortiClientVPNSetup_7.0.3.0193_x64.exe.But Now I see in the console that the FortiClient try to Update something every dayBut my user has no right to update something so it fails everyday.Is there an option to block the forticlient to call to the cloud?Thanks for any hint  

Hello,  I have a question. FortiGate is communicating with Forti Servers to determine the web category. When that communication is disrupted, the firewall stops accepting traffic. Is there a way to overcome this? Thanks and regards, Konstantinos

Hi, following constellation: We have a FortiGate 100E running here. I created a CSR on it to have that signed by our internal CA. I then imported the certificicate to the fortigate which all worked fine. I selected it for to use it for https and that works fine so far. It does do https with that cert and I do not get any more Browser warning (since all our clients know our CA).However the FGT denies me to select that cert for use with SSL Inspection. I can onyl choose the FortiNet built in one here and none of the others installed.Does anyone have a tip why that is? FGT runs FortiOS 5.4.x and our CA runs on Wind*ws btw.FGT is not part of a HA Cluster, a FortiManager or a Fabric..just standalone. CheersSebastian

Hello all I have recently inherited a network of Fortinet gear.  It was mostly setup reasonably well, but there were a number of issues.  It consists of 2 60F which are setup in HA.  3 FortiSwitch 248E-FPOE, and 6 Forti AP 221E.  I have managed to work out most of what needed to be done.  However one odd thing lingers. I have all my FortiSwitch online and accessible through FortiLink, as well as Forti AP managed.  The FortiLink address is 10.109.92.1, and my FortiSwitch are 10.109.92.2/3/4.  From any Fortiswitch I can ping and access the other (for instance from 10.109.92.2 I can SSH to one of the other FortiSwitch at 10.109.2.3).  However I cannot from any switch ping the FortiLink interface of 10.109.92.1, nor from the GUI can I access any Fortiswitch via CLI.  My only option right now to access the Fortiswitch directly if I wanted to is to use a console cable. One challenge I faced was that when I was given this setup the F

I was gifted this awesome device, but now I need to set it up.Where should I start? I currently have an all-in-one cable/modem+wifi/router.Looks like I need to separate them.. this will be for my home/network/lab. I found the "Quick Start" Guide, but I need more helpHow do I get started?Where do you plug the Cable/Modem?Where do you plug the Wireless router?Do I need a 'compatible' kind of wireless router?

Hi Team,We are seeing a strange issue with our FortiAnalyzer which is related to the radius authentication. We have configured Cisco ISE  as a radius authentication server. ISE IP and all other parameters are configured on the Fortianalyzer however authentication is not working.  We have captured the sniffer traffic but do not see any traffic leaving the device. Please advise what could be the issue? Is there any way to restart auth daemon/radius service? We have already rebooted the Fortianalyzer.           FAZ01 # diagnose sniffer packet any "host x.x.x.x" 4 ainterfaces=[any]filters=[host x.x.x.x]^CPlease find the snap for reference.

Hi, I just upgraded to Catalina on my Mac today and whilst the VPN client connects and notifies me of this I can't connect to anything on my network. No pings, SSH, RDP even HTTP work intranet. I was using the VPN this morning successfully on Mojave (10.14) and other users are connected to the VPN so that end is fine. I am using 2FA with Fortitokens and I do get challenged for the token and this appears to be accepted successfully.Forticlient VPN version is 6.2.1.654, I can't find anything newer. Any ideas?

Hello!I have FortiGate-60E Low-Encryptionhttps://kb.fortinet.com/kb/documentLink.do?externalID=FD37333 I have error:This site can’t provide a secure connectionfortigate.local uses an unsupported protocol.ERR_SSL_VERSION_OR_CIPHER_MISMATCH Hide details Unsupported protocol The client and server don't support a common SSL protocol version or cipher suite.       I saw https://forum.fortinet.com/tm.aspx?m=104586 Is FortiGate-60E Low-Encryption support https WebGUI?

In my FortiGate cloud account when choose to manage my Fortigate in Security Fabric tab I get notification: "Current Firmware Version: v6.4.9, build 1966Device config version v6.2.5, build 1142 (6.2.0 - 6.2.10 compatible) does not match device firmware version v6.4.9, build 1966.You can sync by clicking the Import button if changing device firmware version is not preferred." I make update couple of days ago from 6.4.8 to 6.4.9 but we are not on v6.2.5 for ages, so why it showing this device config version 6.2.5?Should I press IMPORT?It will update FortiGate cloud?It will not have any impact on my working production FortiGate? 

ToIP traffic that is already marked with a DSCP (EF) value will pass through my firewall. I need the firewall to keep that value and not modify it. That keep the same input value as output. On the other hand, I also need you to prioritize it internally. If I don't do any configuration and just let traffic through, I'm not sure if the firewall keeps the value or resets it to zero. Can you help me? "If the differentiated services feature is not enabled, the FortiGate unit treats traffic as if the DSCP value is set to the default (00), and will not change IP packets’ DSCP field."Thank you very much

Hi,in the config router multicast-flow source address field is mandatory? I wish to create static IGMP groups only based on destination multicast addresses and not on source addresses. 

Hello, How can I check my FortiClient version in FortiGate ? I just want to use FortiGate and nothing else. FortiGate Version : 6.5 or 7Is it possible to use FortiClient free edition ?

Hi all, I'm trying out Fortigate VM64-AZURE on Azure. My task is to have it as IPsec VPN terminator which allows authorized clients to connect to some Azure vNets that are in peering with VM64 Vnet. Fortigate is in its own Vnet (call it FwvNet), and clients connect to this vnet without problems, i.e. I've put a test vm in the internal vnet, and clients can ping it, ssh and whatever. I've put in peering FwvNet with another vNet, say AppvNet.From the test machine I can ping VMs on Appvnet, but from the IPsec clients I can't.  What am I missing? Thanks for your help

I have to create a static join to group multicast on my firewall PIM dense enabled,  independently from the  join to group requests coming from the user interface . Which instruction do I have to use ? do you believe that creating static join to multicast groups inside the firewall  interfaces can produce PIM management packets to the remote PIM enabled nodes?

 One firewall in my LAN is configured with PIM dense mode and wish to communicate  with another firewall ( same model Fortigate 600D) but configured with multicast forwarding. Can the first node PIM enabled able to transfer and receive multicast traffic with the  second one? and how? If I set the first one in PIM dense passive mode can I resolve the problem?